Guest
|
Hi!
I saw this article and these comments.
playing with virtual pc 2004 can be very very useful.
since I ran myself sometime ago into an exactly the same scenario I think I can
help a little here.
I hope I don't brake any rules here.
virtual pc 2004 can be very useful if you want to test or to learn about ISA Server.
so look how i did it:
first of all I have a broadband router for my Internet connection with 4 LAN ports, a few host
and a wireless lan.
the router has DHCP enabled for certain MAC addresses.
I used for this test an AMD 2800+ Barton, 1 GB of RAM, a KT400 motherboard, a S-ATA
hard-disk and a 9700 Pro video card. For the virtual memory I allocated 3072 MB.
The operating system was XP SP2 Pro.
as you can see it isn't quite a modern system.
so the question is will it hold 4 VM?
sure!!
with all 4 VM running with default settings(just configured networking) and windows media player,
an antivirus I need about 950 MB of RAM and the processor is somewhere between 20-30% usage.
4 VM= 3 Windows 2003 Server R2 Trials + Windows XP SP2 Pro.
Explicit: ISATest=Windows 2003 Server R2 Trial(with RAM settings 256 MB from VPC)
DCTest=Windows 2003 Server R2 Trial(with RAM settings 128 MB from VPC)
DMZTest=Windows 2003 Server R2 Trial(with RAM settings 128 MB from VPC)
XPTest=Windows XP SP2 Pro(with RAM settings 64 MB from VPC).
Note: my Xp uses about 230-250 MB of RAM when it's running with no program, except the antivirus,
the sound manager, video card manager....
So what I did?
First install two loopback network card and as Stefaan said they only have virtual machines network
services enabled.
I've name them Loopback1 and Loopback2.
So: one network called Intern which comprises two computers DCTest and XPTest
one network called DMZ which containd DMZTest.
As it should the ISATest has three network adapters: Extern, Intern, DMZ.
My real network is 192.168.2.0 and the IP of the REALXP host on which is installed VPC is 192.168.2.3.
The default gateway is 192.168.2.1(the router).
On the REALXP host I only have 1 real network adapter( + 2 loopback addresses obviously).
The whole key in order to make this network works is to understand how this virtual networks communicate
with each other.
So for example if you use for a VM in VPC network settings your real network adapter and an IP from your
real network you should have conectivity to ALL YOUR NETWORK(you can ping your router, access Internet,
ping other real computers, you should be able to get your settings from your DHCP server). I set VM to get
its setting from DHCP router and it works just fine.
Now if you are using a loopback adapter, let's say Loopback1 for a host you should use a different network address,
192.168.10.0. The ideea is that if you use again this adapter for another VM you should an IP address from 192.168.10.0
because now all the host using the adapter are belonging to the same LAN.
If you messed things you will not be able to make them run as they should.
So use the two loopback adapters for two different Lan: Loopback1 for 192.168.10.0 for Intern; Loppback2 for 192.168.30.0
for DMZ. All the host from Intern are using Loopback1 and 192.168.10.0(DCTest and XPTest) and all the Host from DMZ are
using Loopback2 and 192.168.30.0(DMZTest).
Pay atention to ISATest. It has 3 network adapter: Loopback1, Real adapter, Loopback2. Keep the order!!!!(You can arrange them
how you like but the you got to stick to that order.)
In ISA desktop you will see in network connections something like that: Intel 21140-Based PCI Fast Ethernet Adapter (Generic),
Intel 21140-Based PCI Fast Ethernet Adapter (Generic)#2, Intel 21140-Based PCI Fast Ethernet Adapter (Generic)#3.
Keep the right order let's say: Loopback1 as Intel 21140-Based PCI Fast Ethernet Adapter (Generic)= Intern.
Real Adapter as Intel 21140-Based PCI Fast Ethernet Adapter (Generic)#2= Extern.
Loopback2 as Intel 21140-Based PCI Fast Ethernet Adapter (Generic)#3= DMZ.
If you don't keep the right order and bind the adapters random it will probably not work.
What are my settings:
ISATest: Extern: 192.168.2.50, DG: 192.168.2.1.
Intern: 192.168.10.1
DMZ: 192.168.30.1
DCTest: Intern: 192.168.10.2 DG: 192.168.10.1
XPTest: Intern: 192.168.10.3 DG: 192.168.10.1
DMZTest: DMZ: 192.168.30.2 DG: 192.168.30.1
Now you shoud be able to ping from DCTest to: 192.168.10.1, 192.168.2.50, 192.168.30.1, 192.198.10.3. The rest will fail.
From ISATest ping works to: 192.168.10.2, 192.168.10.3, 192.168.30.2, 192.168.2.1. Everything.
From DMZ works to: 192.168.10.1, 192.168.30.1, 192.168.2.50. The rest will fail.
From XPTest works to: 192.168.10.1, 192.168.10.2, 192.168.30.1, 192.168.2.50. The rest will fail.
The ISATest is now like a router, so if you want to see that you can ping from let's say from 192.168.30.2 to 192.168.10.3
you should enable routing on ISATest.
How ? from Administrative tools/Routing and Remote Access. Right click on ISATest which is red and Enable.../Custom../Lan Routing.
Now ISATest turns into green.
Attention you will not be able to ping 192.168.2.1 from DMZTest or XPTest.
You can ping now from DMZTest to DCTest and XPTest and vice-versa because you've just enable LAN Routing.
If you want to access the Internet and the real LAN you must enable NAT like above just opt for NAT not for Custom Config.
Choose Extern as public interface and uncheck enable security... because you don't need this now.
Next select let's say Intern(you can add later any interface you want). At the next window check I will setup name and address
services later.
Now you can ping everything.
Of course for Internet or ping let's say "www. .com" you will need to use some DNS servers, maybe from ISP or whatever.
You might try to ping from REALXP some VM.
Well this is another story.
The only thing you can actualy ping is 192.168.2.50. That it.
If you enable NAT in RRAS check in NAT/Basic Firewall on Extern if you are allowing ICMP.
Again what you can ping is 192.168.2.50.
So remember that I said before that for Loopback1 and Loopback2 to set only virtual machine network services?
Well now go to these adapters and enable Client for Microsoft net, File and printer sharing, Internet Protocol and put some IP
addresses there like: Loopback1 192.168.10.10 255.255.255.0 and Loopback2 192.168.30.30 255.255.255.0.
If you didn't enable RRAS you can ping from 192.168.10.0 to 192.168.10.10 and from 192.168.30.0 to 192.168.30.30.
From REALXP you should be able to ping every VM. The rest remain unchanged.
If you enable RRAS Lan Routing remains unchanged like without any IP addresses on loopback adapters except you can
ping 192.168.2.3 from any VM.
Pay atention to NAT/Basic Firewall on Extern and see if you are allowing ICMP. With NAT everything remains unchanged
like without any IP addresses on loopback adapters.
I setup DC, DNS, DHCP servers in 192.168.10.0 and everything works beautiful. The client gets its settings from DHCP....
Obviously this talk about routing has little to do with your ISA lab. It's just to see that EVERYTHING works just fine and
you can use any IP you want(not just 192.168.0.0) and do a lot of things...
For a more in depth analyze of traffic use a traffic analyzer program.
The other settings in VPC networking(Local Only, shared Nat) restrict you too much and give you troubles.No ICS or other
stuff like this.
So do you need vmware?
No.
Maybe I've missed something. I have a tutorial with pictures and more details about VPC and ISA which I will post it somewhere.
Sorry if I've missed something.
Now you can enjoy and apply Mr. Shinder's articles on ISA and test ISA Server in depth.
Have fun.
< Message edited by adrian_dimcev -- 19.Jul.2006 3:23:01 PM >
|
|
My Subscription |
My Forums |
Address Book |
Member List |
Search |
FAQ |
Ticket List |
Log Out
Printable Version
RE: How to build an ISA firewall lab with Virtual PC 2004 - 
New Messages
No New Messages
Hot Topic w/ New Messages
Hot Topic w/o New Messages
Locked w/ New Messages
Locked w/o New Messages
Post New Thread